Web skimming, formjacking or a magecart attack is an
attack where the attacker injects malicious code into a website and extracts data from an
HTML form
A webform, web form or HTML form on a web page allows a user to enter data that is sent to a server for processing. Forms can resemble paper or database forms because web users fill out the forms using checkboxes, radio buttons, or text fields. F ...
that the user has filled in. That data is then submitted to a server under control of the attacker.
Mitigation
Subresource Integrity or a
Content Security Policy
Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. It is a C ...
can be used to protect against formjacking, although this does not protect against
supply chain attacks. A
web application firewall
A web application firewall (WAF) is a specific form of application firewall that filters, monitors, and blocks HTTP traffic to and from a web service. By inspecting HTTP traffic, it can prevent attacks exploiting a web application's known vul ...
can also be used.
Prevalence
A report in 2016 suggested as many as 6,000 e-commerce sites may have been compromised via this class of attack. In 2018,
British Airways
British Airways (BA) is the flag carrier airline of the United Kingdom. It is headquartered in London
London is the capital and List of urban areas in the United Kingdom, largest city of England and the United Kingdom, with a populati ...
had 380,000 card details stolen in via this class of attack. A similar attack affected
Ticketmaster
Ticketmaster Entertainment, Inc. is an American ticket sales and distribution company based in Beverly Hills, California with operations in many countries around the world. In 2010, it merged with Live Nation under the name Live Nation Entert ...
the same year with 40,000 customers affected by maliciously injected code on payment pages.
Magecart
Magecart is software used by a range of
hacking groups for injecting malicious code into ecommerce sites to steal payment details.
As well as targeted attacks such as on
Newegg
Newegg Commerce, Inc. is an American online retailer of items including computer hardware and consumer electronics. It is based in City of Industry, California. It is majority-owned by Liaison Interactive, a multinational technology company.
Hi ...
, it's been used in combination with commodity
Magento
Magento is an open-source e-commerce platform written in PHP. It uses multiple other PHP frameworks such as Laminas (formerly known as Zend Framework) and Symfony. Magento source code is distributed under Open Software License (OSL) v3.0. Ma ...
extension attacks. The 'Shopper Approved' ecommerce toolkit utilised on hundreds of ecommerce sites was also compromised by Magecart as was the conspiracy site
InfoWars
''InfoWars'' is an American far-right conspiracy theory and fake news website owned by Alex Jones. It was founded in 1999, and operates under Free Speech Systems LLC.
Talk shows and other content for the site are created primarily in studi ...
.
According to
Malwarebytes
Malwarebytes Inc. is an American Internet security company that specializes in protecting home computers, smartphones, and companies from malware and other threats. It has offices in Santa Clara, California; Clearwater, Florida; Tallinn, Estonia ...
, the Magecart software has tried to
avoid detection by using the
WebGL
WebGL (Short for Web Graphics Library) is a JavaScript API for rendering interactive 2D and 3D graphics within any compatible web browser without the use of plug-ins. WebGL is fully integrated with other web standards, allowing GPU-accelerated ...
API to check whether a
software renderer
Software rendering is the process of generating an image from a model by means of computer software. In the context of computer graphics rendering, software rendering refers to a rendering process that is not dependent upon graphics hardware AS ...
such as "
swiftshader", "
llvmpipe
Mesa, also called Mesa3D and The Mesa 3D Graphics Library, is an open source implementation of OpenGL, Vulkan, and other graphics API specifications. Mesa translates these specifications to vendor-specific graphics hardware drivers.
Its most ...
" or "
virtualbox
Oracle VM VirtualBox (formerly Sun VirtualBox, Sun xVM VirtualBox and Innotek VirtualBox) is a type-2 hypervisor for x86 virtualization developed by Oracle Corporation.
VirtualBox was originally created by Innotek GmbH, which was acquired by ...
" is used. That would indicate that the software is running in a
virtual machine
In computing, a virtual machine (VM) is the virtualization/emulation of a computer system. Virtual machines are based on computer architectures and provide functionality of a physical computer. Their implementations may involve specialized hardw ...
and thus not a real world victim.
References
{{malware-stub
Hacking (computer security)
Web security exploits
Internet fraud
Carding (fraud)
Types of cyberattacks